SDSI Risk Events And Requirements Practice Test 4 — 15 Questions

Question 1

Which THREE components are critical for an effective post-incident 'Architecture Adaptation'?

Accepted Answer

Updating security policies to address the identified gap.. Option B is correct because architecture adaptation requires updating security policies to close the specific gap that enabled the incident, ensuring governance and controls reflect the lessons learned. Option C is correct because hardening configurations on impacted network devices directly remediates the exploitable weaknesses and prevents recurrence at the architectural/device level. Option E is correct because the Root Cause Analysis (RCA) report identifies the underlying failure and provides the evidence-based foundation for adapting the architecture. Option A is not a structural or architectural change; adding helpdesk staff addresses operational capacity, not the root cause or design gap. Option D is not a remediation or adaptation measure; mass account renaming does not fix the vulnerability and can disrupt identity management without improving security posture.

Answer

Increasing the number of helpdesk staff.

Answer

Renaming all user accounts in the domain.

Question 2

Which risk assessment technique involves evaluating the impact of an attack on the confidentiality, integrity, and availability of an asset?

Accepted Answer

CIA Triad Impact Assessment.. The CIA Triad Impact Assessment evaluates how an attack would degrade Confidentiality, Integrity, and Availability of a specific asset, which is the standard qualitative/quantitative risk technique for scoring asset-level impact. It directly maps threat events to business impact on the three core security pillars, producing the impact half of a risk calculation (Risk = Likelihood × Impact).

Answer

SWOT Analysis.

Answer

Network Penetration Testing.

Answer

Cost-Benefit Analysis.

Question 3

A design requirement for a SOC environment is to have real-time visibility into who is on the network. Which Cisco tool is best for this?

Accepted Answer

Cisco Identity Services Engine (ISE).. Cisco Identity Services Engine (ISE) is the platform that provides real-time visibility into who is on the network by integrating with identity stores (Active Directory, LDAP), profiling endpoints, and enforcing 802.1X/MAB-based access. It continuously tracks authenticated users, device types, and posture, giving SOC teams live contextual awareness of network participants. This makes ISE the correct tool for the stated requirement.

Answer

Cisco SecureX.

Answer

Cisco Umbrella.

Answer

Cisco Firepower Management Center.

Question 4

A security architect is designing a solution to block malicious URLs across all branch offices. Which Cisco feature provides the most efficient, scalable way to manage this across 500+ locations?

Accepted Answer

Cisco Umbrella cloud-delivered DNS filtering.. Cisco Umbrella provides cloud-delivered DNS-layer security, so a single policy change in the Umbrella dashboard instantly applies to all 500+ branch offices without touching each site's firewall. DNS filtering blocks malicious domains before a connection is even established, making it both efficient and scalable for distributed environments.

Answer

Cisco Stealthwatch.

Answer

Cisco Identity Services Engine (ISE).

Answer

Local URL filtering on each branch firewall.

Question 5

During a risk assessment, it is determined that a legacy application cannot be patched. Which Cisco security control should be prioritized to compensate for this vulnerability?

Accepted Answer

Virtual patching via Cisco Secure Firewall IPS.. Virtual patching via Cisco Secure Firewall IPS provides a compensating control for unpatched vulnerabilities by inspecting and blocking exploit traffic at the network layer. It does not require modifying the legacy application, making it ideal when patching is not possible. This approach reduces risk while maintaining availability.

Answer

Cisco Stealthwatch behavioral alerts.

Answer

Cisco AnyConnect VPN.

Answer

Cisco Umbrella DNS blocking.

Question 6

A design requirements document specifies a need for 'Network Segmentation' to contain breaches. Which Cisco technology provides the best granular control using Scalable Group Tags (SGTs)?

Accepted Answer

Cisco TrustSec (SGTs).. Cisco TrustSec with Scalable Group Tags (SGTs) provides the best granular control for network segmentation by enabling identity-based micro-segmentation. SGTs allow policies to be enforced based on group membership rather than IP addresses, which is more scalable and dynamic, effectively containing breaches by limiting lateral movement.

Answer

Cisco Secure Firewall interface zones.

Answer

VLAN-based segmentation.

Answer

Cisco Umbrella local policy.

Question 7

An architect is reviewing post-incident logs in Cisco SecureX. Which feature allows the analyst to see the timeline of events from different integrated products in one view?

Accepted Answer

SecureX Incident/Event Timeline.. SecureX provides an Incident/Event Timeline view that aggregates events from all integrated products (Secure Endpoint, Umbrella, Firepower, Email, etc.) into a single chronological view for an investigation. This is the feature that lets an analyst see the sequence of events across products without pivoting between consoles. The other options are single-product event views that do not aggregate cross-product timelines.

Answer

Stealthwatch Alarms view.

Answer

FMC Event Viewer.

Answer

ISE Auth Reports.

Question 8

Which THREE items should be included in a 'Security Design Requirements' document?

Accepted Answer

List of all potential threat actors and their motivations.. Option B is correct because a Security Design Requirements document must identify the threat landscape it is designed to defend against, so enumerating potential threat actors (e.g., nation-state APTs, insider threats, hacktivists) and their motivations (financial gain, espionage, disruption) directly informs the selection of controls, monitoring use cases, and risk prioritization. Option C is correct because latency requirements for critical business applications are a functional constraint that security controls (such as TLS inspection, WAF, DLP, or zero-trust proxies) must respect; documenting acceptable thresholds (e.g., sub-50 ms response time) ensures security architecture does not break business performance SLAs. Option E is correct because regulatory compliance requirements such as GDPR, HIPAA, PCI DSS, or SOX define mandatory legal and contractual controls (data residency, encryption, breach notification timelines, access logging) that the security design must satisfy, making them a core input to the requirements baseline. Option A is not correct because monitor color schemes are a facilities or ergonomics preference, not a security design requirement. Option D is not correct because security team salary information is an HR and payroll matter and has no bearing on the technical or procedural design of security controls.

Answer

The preferred color scheme for the SOC monitors.

Answer

The salary information of the security team.

Question 9

Which TWO Cisco technologies should be used to protect a data center against lateral movement of threats?

Accepted Answer

Cisco Secure Network Analytics (Stealthwatch).. Cisco Secure Network Analytics (Stealthwatch) (B) is correct because it uses NetFlow/IPFIX telemetry and behavioral analytics to detect anomalous east-west traffic inside the data center, which is exactly how lateral movement between workloads appears. Cisco Secure Workload (Tetration) (E) is correct because it provides microsegmentation and workload-level policy enforcement based on application dependencies, allowing you to block unauthorized host-to-host communication that lateral movement relies on. Together these two address detection and prevention of lateral threat movement within the data center. Cisco Umbrella (A) is DNS-layer security focused on internet-bound resolution, not internal east-west traffic. Cisco Secure Email (C) protects against email-borne threats at the gateway, unrelated to lateral movement. Cisco AnyConnect (D) is a VPN/remote-access client for securing user connectivity, not for containing internal data center threats.

Answer

Cisco Umbrella.

Answer

Cisco Secure Email.

Answer

Cisco AnyConnect.

Question 10

Which Cisco product is specifically designed to provide visibility into encrypted traffic without the need for manual decryption?

Accepted Answer

Cisco Encrypted Traffic Analytics (ETA).. Cisco Encrypted Traffic Analytics (ETA) uses machine learning and network telemetry to identify malware in encrypted traffic without decrypting it. It analyzes flow metadata and sequence of packet lengths and times (SPLT) to detect threats, preserving privacy and reducing complexity. This is specifically designed for visibility into encrypted traffic.

Answer

Cisco Identity Services Engine (ISE).

Answer

Cisco Stealthwatch.

Answer

Cisco Firepower IPS.

Question 11

A design architect is updating an incident response strategy. What is the role of the 'Post-Incident Architecture Adaptation' phase?

Accepted Answer

To identify and implement changes to prevent recurrence of the incident.. The Post-Incident Architecture Adaptation phase is where lessons learned from an incident are translated into concrete architectural and policy changes to prevent recurrence. It is not about cost accounting, audit documentation, or HR discipline — it is about feeding findings back into the design so the same class of incident is mitigated or eliminated. This aligns with the NIST IR lifecycle 'lessons learned' and continuous improvement stages.

Answer

To document the costs of the incident.

Answer

To update the network documentation for the next annual audit.

Answer

To discipline employees who caused the incident.

Question 12

When conducting a risk assessment, what is the best way to determine the value of an asset to the organization?

Accepted Answer

Perform a Business Impact Analysis (BIA).. A Business Impact Analysis (BIA) is the formal process for determining the criticality and value of assets by assessing the operational, financial, legal, and reputational impact of their loss or disruption. It identifies critical business functions, dependencies, and recovery objectives (RTO/RPO), which directly translate into asset value for risk assessment. Manufacturer price, IT opinion, and hardware replacement cost reflect only acquisition cost, not business value.

Answer

Check the manufacturer's list price.

Answer

Ask the IT department for their opinion.

Answer

Check the hardware replacement cost.

Question 13

A security architect is configuring Cisco SecureX for the first time. Which is the most important step to enable centralized incident response?

Accepted Answer

Integrating product API credentials (e.g., Secure Endpoint, Umbrella).. Cisco SecureX aggregates data and enables automated workflows across Cisco security products by integrating their APIs. To enable centralized incident response, you must integrate product API credentials (e.g., Secure Endpoint, Umbrella, Firepower) so SecureX can pull events, correlate them, and trigger response actions. Without API integration, SecureX has no data to work with.

Answer

Setting the dashboard background color.

Answer

Manually uploading log files.

Answer

Renaming all the products in the dashboard.

Question 14

Which Cisco product is best for enforcing security policy based on the user's AD group membership?

Accepted Answer

Cisco Identity Services Engine (ISE).. Cisco Identity Services Engine (ISE) is the product designed to enforce security policy based on user identity and AD group membership. ISE integrates with Active Directory to retrieve group memberships and uses that information in authorization policies, which can then be enforced on network devices via RADIUS, TrustSec, or pxGrid. This makes ISE the correct choice for identity-based policy enforcement tied to AD groups.

Answer

Cisco Umbrella.

Answer

Cisco Secure Firewall.

Answer

Cisco Stealthwatch.

Question 15

Which TWO Cisco products are used to achieve 'Zero Trust' for remote users?

Accepted Answer

Cisco Identity Services Engine (ISE).. Cisco Identity Services Engine (ISE) (B) is correct because it provides the policy decision and enforcement point for Zero Trust, performing identity-based authentication, authorization, posture assessment, and network access control (via RADIUS, 802.1X, and TrustSec/SGT) so that remote users are granted least-privilege access based on identity and device compliance. Cisco AnyConnect (D) is correct because it is the endpoint client that establishes the secure remote-access tunnel (SSL/TLS or IPsec IKEv2) and feeds endpoint posture and identity context into ISE, enabling continuous trust verification for remote users. Cisco Umbrella (A) is a DNS-layer and secure web gateway security service, not the identity/posture policy engine or the remote-access client required for Zero Trust enforcement. Cisco Stealthwatch (C) is network traffic visibility and anomaly detection (flow analysis), and Cisco Secure Email (E) is email security; neither provides the identity-based access control or remote-user tunnel needed for Zero Trust.

Answer

Cisco Umbrella.

Answer

Cisco Stealthwatch.

Answer

Cisco Secure Email.